CVE-2026-119208 pypdf: Possible long runtimes/large memory usage for encrypted PDF files
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119208?
CVE-2026-119208 is a high-severity vulnerability in py-pdf pypdf, published on 29 Oct 2026.
Official description
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3.
Weakness: CWE-400
Which versions are affected by CVE-2026-119208?
How do I fix CVE-2026-119208?
No fix has been published for CVE-2026-119208 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119208 being exploited?
There is no known exploitation of CVE-2026-119208 in the wild and no public exploit code.